Download Fig 2 : Information Security Cycle

INFORMATION SECURITY AUDITING:
THE MISSING LINK?
Cheryl Vrooma & Rossouw von Solmsb
Port Elizabeth Technikon
a
[email protected], PO Box 1898 George 6530, +27724000930
b
[email protected], Private Bag X6011 PE 6000,
All elements with regard to information security have become a high priority to most
organizations nowadays. These components can basically be divided into three categories
- namely the physical, strategic and behavioural aspects. The first two aspects can be
audited or checked to ensure that they are of the highest standard by introducing
established forms of auditing, namely IT auditing and IS security auditing.
However the final aspect, that of auditing human behaviour, is much more complex. The
employee himself needs some form of checking or auditing, but the problem lies in the
practicalities of auditing employee behaviour.
There are guidelines to auditing of
systems and procedures, yet when the concept of human nature comes into the equation,
auditing is suddenly not as cut and dried. Many problems are associated with auditing
employee behaviour and so a viable alternative needs to be found for the company.
But what if it were possible to minimize or even negate the requirement of behavioural
auditing? In a perfect situation, it would not be necessary to audit the users, because they
would automatically follow the rules and regulations set out by the information security
policies.
This paper explores the alternative option of establishing an information
security culture in order to nullify the need for behavioural auditing in an organization
with regard to information security.
Keywords: Information Systems (IS) Security Auditing, Information Technology (IT)
Auditing, Information Security Culture, Mentoring.
INFORMATION SECURITY AUDITING:
THE MISSING LINK?
1. INTRODUCTION
Information has become an organization’s most prized asset nowadays and so too has the
security of this information become vitally important. But information security is no
longer only about the physical aspect where locked doors and security guards are enough
to protect the organization’s information.
Nowadays, information security plays an important role in the strategic management of
an organization.
It has become top management’s responsibility to ensure that
information security is communicated to all employees through policies, procedures,
practices and organizational structures. (Cobit, 1998)
The employee, and his behaviour, too has a responsibility towards the company to protect
the confidentiality, integrity and availability of the valuable assets of the organization.
Users need to be educated in the discipline of information security and their behaviour
should reflect this. (Thomson & von Solms, 1998)
These three aspects – the physical, strategic and behavioural aspect together create a
complete information security cycle where security is at an optimum. All aspects of
security need to be covered in order to achieve an airtight information security cycle.
However, the current information security cycle is flawed and incomplete. To understand
the concept of a complete security cycle, a parallel must first be drawn with one that has
been tried and tested over many years.
2. A TESTED SECURITY CYCLE
An example of a complete, working security system would be the traffic safety cycle. By
examining it, the system can be divided into three different elements, as explained in the
previous section, namely –

Physical – the physical, tangible products that are utilized in the system

Strategic – the principles, rules and regulations on which the whole system is based

Behavioural – this involves the people side of the system, how people in the cycle
behave and their influence in the total success of the cycle.
With regard to the traffic safety cycle, the physical aspect would be the safety products
that are physical in nature, such as safety belts in the car, tyres that are not worn through,
airbags, etc. The strategic aspect would involve knowing the rules of the road that a
potential driver would need in order to drive legally. The final aspect concerned would
involve the behaviour of the actual drivers, such as obeying red lights, not exceeding the
speed limit, etc.
These three elements make up a complete, working safety cycle. However, although all
three of these elements seem as if they are standalone components, only together do they
make up a complete and stable cycle. Each element would also not be as strong if there
was not some form of checking up on them to ensure that it is at its highest possible
standard.
The type of double-checking of element can also be referred to as the
“auditing” of each component.
As can be seen by the model below in Fig 1, each element within the traffic safety cycle
can be audited to ensure that it is of the highest standard.
On the physical side, the actual physical parts of the car are “audited” or checked via the
issuing of a roadworthy certificate. This certificate is needed to ensure that the physical
car meets the requirements with regard to safety.
PHYSICAL
e.g. safety belts
tyres…
Audit
Roadworthy
certificate
STRATEGIC
Rules and
regulations
BEHAVIOURAL
Driver
behaviour
Audit
Audit
Theory
Learner’s
Law
Traffic Cops
Practical
Lessons
Driving Test
Education
Fig 1 : Traffic Safety Cycle
The second aspect, the rules of the road, needs to be known by all potential drivers. This
can be tested or checked through the stipulation of the law, which maintains that every
driver is required to pass the driver’s license test in order to be able to drive legally. The
driving test itself is a reflection of the law, and will change if the law changes in any way.
The law audits the strategic aspect, ensuring that the rules and regulations are compliant
with the legal requirements of the country.
The driving test has to be passed in order to legally be able to drive and to do this
education is required. The potential driver firstly completes some type of theoretical
instruction in the form of a learner’s license. This teaches the driver, in theory, the rules
of the road, but does not teach him how to drive. His education is still incomplete,
because although theoretically he knows the laws, he actually has no idea how to put it
into practice. Hands-on training is required in order for his behaviour to be correct when
driving.
This is done using one-on-one driving lessons with an instructor.
Only
personalized training helps – the potential driver cannot sit in a group and be told how to
drive, h needs to experience driving first hand with someone their to guide him. This is
how his behaviour will develop into the proper way of doing things.
The actual behaviour of the legal drivers can be audited and checked through the use of
traffic officers, who perform routine and random checks on drivers. They check the
driver’s license and that the laws or the road are obeyed, such as stopping at red lights,
etc.
Each type of auditing is crucial to ensure that the complete traffic safety system is of the
highest standard and working properly. Each aspect on its own protects its domain, but
none can stand alone, only the combined effort by all three eleme
nts make up the
complete working safety cycle.
3. THE INFORMATION SECURITY CYCLE
As was seen in the previous example, auditing again has a prominent role in the
protection of information. Without auditing of each aspect, the cycle of infomraiton
security is incomplete and therefore vulnerable to attack. Auditing plays an important
part as it has done from the earliest stages of business when it was discovered that
protecting assets and information was not enough.
The processes, controls and
regulations too have to be investigated to ensure that the company functions in an orderly
fashion, safeguards its assets and secures the reliability and accuracy of the information.
(Cooper, 1979, p28)
The approach used in the traffic security cycle can be applied to the sector of information
security and the auditing of this discipline. By adapting the model in Fig 1, a graphical
representation can be made of information security and the cycle used to achieve the
highest form of security.
PHYSICAL
e.g. password
system
IT Auditing
STRATEGIC
Information
Security
Policies
BEHAVIOURAL
User
behaviour
Audit
Audit
Theory
Awareness
?
Practical
Mentoring
Security
Education
Audit
Security
Education
Law
Education
Fig 2 : Information Security Cycle
The physical component consists of all the tangible products that are utilized in the
business for information security, including components that can be physically touched
and those features that are incorporated into the computer software. Examples of these
would be access controls cards and authentication software. (Barnard & von Solms,
1998, p 72)
This physical aspect can be audited to ensure that the physical components are of the
highest standard.
This type of auditing is known as Information Technology (IT)
auditing. It has evolved from traditional auditing since the introduction of computers into
mainstream business and the globalization of business transactions nowadays.
IT
auditing involves auditing the technology and the infrastructure of the computers with
regard to the transfer of information. (Paliotta, 1999)
The second aspect, namely the strategic aspect, relates to the rules and regulations
regarding information security. This involves the information security policies of the
business, guidelines that dictate the rules and regulations of the organization, which in
turn govern the security of information and its related information systems. (Halliday &
von Solms, 1997, p 12) These policies can be established by using tried and tested
information security standards, such as ISO 17799 or GMITS.
These international standards and guidelines are used to provide a comprehensive set of
controls and procedures comprising best practices in information security and to achieve
the specific security requirements that have been set by management. (BSI, 1999, p1)
In order to audit the security policies of the organization, a fairly recent type of auditing
has evolved, namely Information Systems (IS) security auditing, wherein the actual
policies are audited in order to ensure that the policies are indeed of the highest standard
for safeguarding information and the other valuable assets of the organization according
to the law of the country.
The final aspect is the actual behaviour of the employees. How they act in situations can
potentially damage the security of the organization. The other two elements, namely the
physical and strategic components can be secure, but if the behavioural side is not of the
highest standard as well, the information security cycle is not complete and so the
organization’s information becomes vulnerable to attack, whether intentional or not.
For example, a business could have an extremely secure authentication system, in which
access control cards are used, covering the physical aspect of information security.
Likewise, the strategic aspect is covered by the information security policies which states
the rules and regulations regarding the use of access cards, amongst them being that no
one besides the owner of a particular card may make use of it.
However, an employee may allow a fellow colleague or an unauthorized person to use his
or her card to gain access to confidential information. In this case, although the first two
aspects are highly secure, the security circle has still been broken, making it virtually
useless and vulnerable to attack.
Therefore, the behaviour of the employee is vitally important to the security of the
organization and this behaviour needs to be investigated to ensure that the guidelines, as
dictated in the information security policies, are adhered to for a complete and
impenetrable information security cycle.
Many international security standards stress the significance of the employee, and his
behaviour in the organization, and is one of the critical factors to the success of the
business and its security. (BSI, 1999, p2) The behaviour of the user needs some form of
checking or auditing.
The problem lies in the practicalities of auditing employee
behaviour. There are guidelines to auditing of systems and procedures, yet when the
concept of human nature comes into the equation, auditing is suddenly not as cut and
dried.
Amongst the many problems associated with auditing of employee behaviour, a few that
can be highlighted are –

Expenses Involved

Lack of Resources and Manpower

Privacy Issues
It is not viable for any company to audit every employee in the organization without
spending a great deal of money and manpower. The problem therefore exists in the fact
that auditing of user behaviour with regard to information security is not an option and so
an alternative method needs to be found.
But what if it were possible to minimize or even negate the requirement of behavioural
auditing? In a perfect situation, it would not be necessary to audit the users, because they
would automatically follow the rules and regulations set out by the information security
policies.
4. AN INFORMATION SECURITY CULTURE
The ideal solution would be a complete and proper information security culture. Edgar
Schein defines organizational culture as:
“the pattern of basic assumptions that a given group has invented, discovered, or
developed in learning to cope with its problems of external adaptation and
internal integration, and that have worked well enough to be considered valid,
and, therefore to be taught to new members as the correct way to perceive, think,
and feel in relation to those problems.”
A utopian information security culture would be where the employees of the organization
follow the guidelines of the organization automatically as part of their second nature. For
example, it becomes routine for an employee to change his password on the first Monday
of every month, because it is part of the culture and everybody automatically does it.
Once an overall and uncompromising information security culture has been established
and nurtured, the need for total checking up on employees can be reduced to a minimum.
The need for behavioural auditing of employees in the organization becomes negligent if
a strong culture of information security is maintained.
An example of a proved culture would be the traffic culture in Australia. Virtually all
drivers obey the speed limit of 110 km/h, because it has become routine and a way of life.
While the traffic officers are still there to patrol the highways, they are few and far
between. This is due to the fact that the drivers are “bred” to obey the traffic laws,
through seeing other drivers obey and understanding the penalties of disobeying.
However, this type of strong culture is not established overnight. Employees cannot be
expected to adapt to a way of doing things in certain way immediately, especially if they
are used to doing it completely differently. It is something that needs to be built and
nurtured over time, but the question is how to establish a solid information security
culture.
5. ESTABLISHING AN INFORMATION SECURITY CULTURE
Consideration needs to be taken in order to establish and maintain a stable information
security culture. Once this is in place, the need for auditing the employee is minimized.
It needs to be decided on how to establish this culture, whether there is some form of
culture that is already present or if it must be accomplished from scratch.
A number of factors will influence the information security culture to ensure that it
becomes the best possible culture for that particular organization. The two primary
factors that will influence are auditing and education.
Auditing is necessary in the early stages of developing an information security culture, a
form of policing to ensure that the culture is developing properly and according to the
rules and regulations of the organization. As the information security culture reaches its
final stages of development and becomes a stable and solid culture, the need for auditing
is reduced, until proven virtually superfluous.
The other important factor in building a balanced information security culture is
education. Employees have to be taught and educated about the information security
policies, as the drivers were taught in the previous traffic safety example. Security
policies are completely useless if the employees are not made aware of and taught them
and incorporated into their daily routine. Again the education is two pronged, using both
the theoretical and practical components. Theoretical education would be in the form of
security awareness programs, teaching users about the dangers of security vulnerabilities
and the solutions that should be implemented to prevent these vulnerabilities. Here the
information security policies are tutored, as the rules of the road were taught via the
learner’s license.
However, even though the employee might know the rules, it does not mean that he will
put it into practice. For this, like in the traffic example, it would be best done by handson individual instruction. Having someone there to teach the person personally, allowing
for all types of situations in a practical, business environment would seem the best
solution to educating about information security.
Proper education in information
security, combined with the proper auditing of user behaviour, is the key to creating a
strong information security culture in the organization.
A formal policy of information security education is required to accomplish the desired
level of culture. Informal education on an individual basis should be used in tandem to
this, so that as the formal education is tapered down, the one-on-one education of the
employees takes preference as the desired culture takes shape.
Likewise, the need for stringent auditing of behaviour that was originally required when
the culture was not the sought after one, now becomes less and less. As the desired
culture takes shape, the need for strict, formal education, as well as stringent auditing
becomes less and less. Once the coveted information security culture has been reached,
the need for auditing the employee is minimal and the type of education of information
takes on a less formal approach. This less formal education can best be done through the
personalized instruction described earlier, otherwise know as mentoring.
6. MENTORING
Mentoring can best be described as a protected relationship – usually between two
people, one the mentor, the other the mentee – in which learning and experimentation can
take place in order to achieve certain goals (Collin, 1988). The mentee will go to the
mentor for advice, learning etc. and the mentor, in turn, teaches his or her student the way
things are best done. Research proves that this type of mentoring thrives in a less
structured atmosphere and is a powerful and cost-effective method of encouraging
development (Gibbons, 2001) and that it is widely recognized for encouraging personal
and organizational development. (Guest, 1999)
If this type of approach can be applied to information security, where the mentor teaches
his mentee the way things are done from the very beginning, a culture will develop. As
the culture develops, so too will the mentee, eventually becoming the mentor to a new
employee and so teaching them the way the organization operates. Therefore a hierarchy
develops where each employee, from the top to the bottom, becomes both a mentor and a
mentee, always able to rely on their teacher and at the same time being able to teach.
This type of approach needs to be taken from the highest level in the business, from top
management to the newest employee. In doing this, a culture develops where everyone
follows the same set of rules and regulations as dictated by the information security
policies originally set up by top management.
7. CONCLUSION
Once this mentoring relationship exists between employees, the information security
culture becomes secure, and the need for strict auditing of employee behaviour becomes
negligent, yet the information security cycle has been completed. There may be no
practical way to audit employee behaviour, but if the information security culture can be
established, there is very little need for it.
8. REFERENCES
Barnard, L. & von Solms, R. (1998). The evaluation & certification of information
security against BS 7799. Information Management and Computer Security 6(2), pp.7277. MCB University Press.
British Standards Institution. (1999). Code of Practice for Information Security
Management. DISC PD 0007. London.
Collin, A. (1988). Mentoring. Industrial and Commercial Training March/April 1988,
pp 23-27. MCB University Press.
Cooper, V.R.V. (1979). Student’s Manual of Auditing. London:Gee & Co (Publishers)
Limited.
Guest, A. (1999). A Coach, a Mentor... a What? [online]. [Cited March 4, 2003]
Available from Internet URL
http://www.coachingnetwork.org.uk/ResourceCentre/Articles/Documents/ACoachAMent
orAWhat.htm
Gibbons, A. (2001). Getting the most from mentoring – recent developments and learning
[online]. [Cited March 5, 2003] Available from Internet URL
http://www.coachingnetwork.org.uk/ResourceCentre/Articles/Documents/MostFromMen
toring.htm
Halliday, J. & von Solms, R. (1997). Effective Information Security Policies. In von
Solms, R. (Ed). Information Technology on the Move (pp. 12 – 20). Port Elizabeth : Port
Elizabeth Technikon.
Paliotta, A.R. (2001). A Personal View of a World Class IT Auditing Function. [online].
[Cited May 11, 2002] Available from Internet URL
Thomson, M. & von Solms, R. (1998). Information Security Awareness: educating your
users effectively. Information Management and Computer Security 6(4), pp.167-173.
MCB University Press.
Acknowledgement: We would like to thank the National Research Foundation for their
financial support for research conducted towards this paper.